package com.yky.filter.admin;

import java.io.IOException;
import java.io.UnsupportedEncodingException;
import java.net.URLDecoder;
import java.text.SimpleDateFormat;
import java.util.Date;
import java.util.Enumeration;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletOutputStream;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

/**
 * 过滤器
 * 
 * @author vimesly
 * 
 */
public class LoginFilter implements Filter {

	/**
	 * 
	 */
	private static final long serialVersionUID = 1L;
	protected String tmp = "exec|insert|select|delete|update|count|chr|mid|master|truncate|char|declare|or|alert|script|&|function|location";

	private FilterConfig config;

	public void destroy() {

	}

	@SuppressWarnings( { "rawtypes" })
	public void doFilter(ServletRequest arg0, ServletResponse arg1,
			FilterChain arg2) {

		HttpServletRequest request = (HttpServletRequest) arg0;
		HttpServletResponse response = (HttpServletResponse) arg1;
//		System.out.println("....loginFilter..referer:"
//				+ request.getHeader("referer"));

		Enumeration enu = request.getParameterNames();
		String servletPath = request.getServletPath();
		String path = request.getContextPath();
		String basePath = request.getScheme() + "://" + request.getServerName()
				+ ":" + request.getServerPort() + path;

		String sql = "";
		// 对所有参数进行循环
		while (enu.hasMoreElements()) {
			// 得到参数名
			String name = (String) enu.nextElement();
			// 得到这个参数的所有值
			String[] value = request.getParameterValues(name);
			for (int i = 0; i < value.length; i++) {
				sql = sql + value[i];
			}
		}

		try {
			sql = URLDecoder.decode(sql, "utf-8");
		} catch (UnsupportedEncodingException e) {
			System.out.println("拦截解码异常!");
		}
		sql = sql.toLowerCase();

		boolean bool = false;
		String inj_stra[] = this.tmp.split("\\|");
		for (int i = 0; i < inj_stra.length; i++) {
			if (sql.indexOf(inj_stra[i]) > -1) {
				bool = true;
				break;
			}
		}
		if (bool) {
			SimpleDateFormat sdFormat = new SimpleDateFormat(
					"yyyy-MM-dd HH:mm:ss");
			System.out.println("[警告]：" + sdFormat.format(new Date())
					+ "  可能有sql注入攻击,已成功拦截！");
			try {
				ServletOutputStream out = response.getOutputStream();
				response.setStatus(401);
				out.print("<script>window.location.href='" + basePath
						+ "/index.jsp';</script>");
			} catch (IOException e) {
				e.printStackTrace();
			}

		} else {
			if (null == request.getSession().getAttribute("username")) {
				if(!"/ethicscommittee_records_search.jsp".equals(servletPath) ){
				if(!"/ethic_list.jsp".equals(servletPath) ){
				if(!"/ethic_detail.jsp".equals(servletPath) ){
				if(!"/index_project.jsp".equals(servletPath) ){
				if(!"/ethicscommittee_records_particulars.jsp".equals(servletPath)){
				if(!"/organization_records_detail.jsp".equals(servletPath)){
				if (servletPath.endsWith(".html") || servletPath.endsWith(".jsp") || servletPath.endsWith(".action")) {
					if (servletPath.endsWith("/index.jsp")|| servletPath.endsWith("/admin/index.jsp")
							|| servletPath.endsWith("/admin/login!loginSystem.action")
							|| servletPath.endsWith("/admin/org!getProvinceList.action")
							|| servletPath.endsWith("/admin/org!saveOrgUser.action")
							|| servletPath.endsWith("/admin/org!checkuser.action")
							|| servletPath.endsWith("/admin/org!checkOrgcode.action")
							|| servletPath.endsWith("/index/reg.jsp")
							|| servletPath.endsWith("/index/complain.jsp")
							|| servletPath.endsWith("/admin/login!exitSystem.action")
							|| servletPath.endsWith("/project_detail.jsp")
							|| servletPath.endsWith("/index/regSucess.jsp")
							|| servletPath.endsWith("/index/project-search!find.action")
							|| servletPath.endsWith("/index/project-search!getOrgListByProvince.action")
							|| servletPath.endsWith("/index/project-search!getProvinceList.action")
							|| servletPath.endsWith("/index/project-search!getPageCount.action")
							|| servletPath.endsWith("/index/project-search!getPageList.action")) {
						try {
							arg2.doFilter(request, response);
						} catch (IOException e) {
							// TODO Auto-generated catch block
							e.printStackTrace();
						} catch (ServletException e) {
							// TODO Auto-generated catch block
							e.printStackTrace();
						}
					} else {
						try {
							ServletOutputStream out = response
									.getOutputStream();
							out.print("<script>window.parent.location.href='"
									+ request.getContextPath()
									+ "/index.jsp';</script>");
						} catch (IOException e) {
							e.printStackTrace();
						}
						;
					}
				} else {
					try {
						arg2.doFilter(request, response);
					} catch (IOException e) {
						// TODO Auto-generated catch block
						e.printStackTrace();
					} catch (ServletException e) {
						// TODO Auto-generated catch block
						e.printStackTrace();
					}
				}
			} else {
				try {
					arg2.doFilter(request, response);
				} catch (IOException e) {
					// TODO Auto-generated catch block
					e.printStackTrace();
				} catch (ServletException e) {
					// TODO Auto-generated catch block
					e.printStackTrace();
				}
			}
				} else {
					try {
						arg2.doFilter(request, response);
					} catch (IOException e) {
						// TODO Auto-generated catch block
						e.printStackTrace();
					} catch (ServletException e) {
						// TODO Auto-generated catch block
						e.printStackTrace();
					}
				}
			} else {
				try {
					arg2.doFilter(request, response);
				} catch (IOException e) {
					// TODO Auto-generated catch block
					e.printStackTrace();
				} catch (ServletException e) {
					// TODO Auto-generated catch block
					e.printStackTrace();
				}
			}
			} else {
				try {
					arg2.doFilter(request, response);
				} catch (IOException e) {
					// TODO Auto-generated catch block
					e.printStackTrace();
				} catch (ServletException e) {
					// TODO Auto-generated catch block
					e.printStackTrace();
				}
			}
			} else {
				try {
					arg2.doFilter(request, response);
				} catch (IOException e) {
					// TODO Auto-generated catch block
					e.printStackTrace();
				} catch (ServletException e) {
					// TODO Auto-generated catch block
					e.printStackTrace();
				}
			}
			} else {
				try {
					arg2.doFilter(request, response);
				} catch (IOException e) {
					// TODO Auto-generated catch block
					e.printStackTrace();
				} catch (ServletException e) {
					// TODO Auto-generated catch block
					e.printStackTrace();
				}
			}
			} else {
				try {
					arg2.doFilter(request, response);
				} catch (IOException e) {
					// TODO Auto-generated catch block
					e.printStackTrace();
				} catch (ServletException e) {
					// TODO Auto-generated catch block
					e.printStackTrace();
				}
			}
		}

	}

	public void init(FilterConfig filterConfig) throws ServletException {
		this.config = filterConfig;

	}

}
